@redue/cli 0.1.0-alpha.10 → 0.1.0-alpha.11

package/src/daemon.mjs

@@ -1,4 +1,4 @@
-import {inflateSync} from 'node:zlib';
+import {inflateSync,deflateSync} from 'node:zlib';
 import fs from 'node:fs';
 import path from 'node:path';
 import net from 'node:net';
@@ -15,8 +15,11 @@ import {InputIndex} from './index.mjs';
 import {permittedRoots} from './installed-inputs.mjs';
 import {assertOwnedStatePlacement} from './owned-state.mjs';
 import {atomicJson,readReceipts,readReceiptSnapshot,receiptRevision} from './state-store.mjs';
-import {history} from './observation.mjs';
-import {inputKey,planGuard} from './decision-validation.mjs';
+import {history,closeHistory} from './observation.mjs';
+import {inputKey,planGuard,toolchainKey} from './decision-validation.mjs';
+import {queriesHold} from './typescript-list.mjs';
+import {directProject,directProbeValue} from './direct-typescript.mjs';
+import {recordedCertificate} from './direct-run-certificate.mjs';
 import {timing,mark,traceBase,traceContext,traceScope,traceEnvironment,traceId} from './decision-profile.mjs';
 
 const configFile=path.resolve(process.argv[2]);
@@ -111,12 +114,45 @@ function persistedPlan(bundle) {
       return [name,safe];
     }))};
 }
-function macProbeBarrier() {
-  return process.platform==='darwin'&&hasHistory&&!historyDisabled&&healthy&&
-    watcher&&!planning&&!recovering&&!planDirty&&!index?.unavailable&&
+// Continuity for in-process certificate reuse: every observed change is applied.
+// macOS needs its history cursor; Linux has the synchronize barrier in catchUp.
+// Windows reconciles content at each decision and keeps its own reuse path.
+function continuityBarrier() {
+  return process.platform!=='win32'&&(process.platform!=='darwin'||hasHistory&&!historyDisabled)&&
+    healthy&&watcher&&!planning&&!recovering&&!planDirty&&!index?.unavailable&&
     !pending.size&&!pendingChecks.size&&!external.size&&verifyRoot();
 }
-function probe(row,allowReuse=false) {
+// The basis a full direct probe is checked against: plan guard, observation
+// continuity, and the compiler tree and Node identity taken before the probe.
+function certificateBasis(row) {
+  const argv=row.plan.probes[0],compiler=directProject(argv[2],argv[3],{verify:false});
+  return {guard:planGuard(index.bundle),gaps:metrics.gaps,
+    compiler:JSON.stringify([compiler.tsRoot,compiler.entry,compiler.digest]),
+    toolchain:toolchainKey(compiler.tsRoot,argv[0])};
+}
+// Returns null after reusing the last full probe, otherwise why a full probe is needed.
+function reuseCertificate(row,key,allowReuse,forceFull,checked) {
+  const started=performance.now(),cache=row.probeCache;
+  if(forceFull)return 'forced_full_reference';
+  if(!allowReuse||!continuityBarrier())return 'continuity_unavailable';
+  if(row.plan.unresolved.length)return 'coverage_unresolved';
+  if(!cache?.queries?.length)return 'no_validated_result';
+  if(cache.input!==key)return 'inputs_changed';
+  if(cache.gaps!==metrics.gaps)return 'observation_gap';
+  let reason=null;
+  try{const basis=checked.basis=certificateBasis(row);
+    if(basis.guard!==cache.guard){planDirty=true;reason='plan_guard_changed';}
+    else if(basis.compiler!==cache.compiler||basis.toolchain!==cache.toolchain)reason='toolchain_changed';
+    else if(!queriesHold(cache.queries,cache.identities))reason='compiler_queries_changed';}
+  catch{reason='validation_unavailable';}
+  timing('daemon.probe_validation',started,{outcome:reason?'changed_or_unavailable':'reused',
+    reason:reason||'content_and_context_unchanged',queries:cache.queries.length});
+  if(reason)return reason;
+  row.probeHash=cache.hash;row.probeAt=Date.now();row.probeError=null;
+  metrics.probeReuses=(metrics.probeReuses||0)+1;
+  return null;
+}
+function probe(row,allowReuse=false,{launch=true}={}) {
   const started=performance.now();
   const supported=new Map([
     ['typescript-noemit-v1','typescript-contract-probe.mjs'],
@@ -124,47 +160,49 @@ function probe(row,allowReuse=false) {
     ['yarn-workspace-tsc-v1','yarn-workspace-typecheck-probe.mjs'],
     ['pnpm-tsc-v1','pnpm-typecheck-probe.mjs']]);
   const expected=supported.get(row.plan.qualification);
-  const macDirect=process.platform==='darwin'&&row.plan.qualification==='npm-typescript-direct-v1';
-  const cacheable=(process.platform==='win32'||macDirect)&&row.plan.probes.length===1&&expected&&
+  const builtIn=row.plan.probes.length===1&&expected&&
     row.plan.probes[0][1]===fileURLToPath(new URL(expected,import.meta.url));
+  const inProcess=builtIn&&process.platform!=='win32'&&row.plan.qualification==='npm-typescript-direct-v1';
+  const cacheable=builtIn&&(process.platform==='win32'||inProcess);
   const key=inputKey(row);
-  let guard=null,guardReason=null;
-  if(macDirect&&cacheable)try{guard=planGuard(index.bundle);}catch{guardReason='plan_guard_unavailable';}
-  const cache=row.probeCache;
-  const macGuarded=!macDirect||(macProbeBarrier()&&!row.plan.unresolved.length&&
-    guard!==null&&cache?.schema===1&&cache.guard===guard&&
-    Array.isArray(cache.queries)&&cache.queries.length>0);
   const forceFull=process.env.VSTATE_TEST_FAULTS==='1'&&process.env.VSTATE_TEST_FULL_PROBES==='1';
-  if(cacheable&&allowReuse&&macGuarded&&!forceFull&&cache?.input===key){
+  let fullReason=null;const checked={};
+  if(inProcess){
+    fullReason=reuseCertificate(row,key,allowReuse,forceFull,checked);
+    if(!fullReason)return;
+  }
+  // Idle revalidation never launches a process. An unconfirmed result expires.
+  if(!launch&&row.plan.probes.length)return;
+  if(process.platform==='win32'&&cacheable&&allowReuse&&!forceFull&&row.probeCache?.input===key){
     const argv=row.plan.probes[0];
     mark('daemon.probe_launch',{mode:'certificate',deadlineMs:10000});
-    const out=spawnSync(argv[0],[...argv.slice(1),macDirect?'--redue-validate-queries':'--redue-context'],{
-      cwd:row.plan.cwd,timeout:10000,maxBuffer:1024*1024,env:traceEnvironment(),
-      ...(macDirect?{input:JSON.stringify({schema:cache.schema,context:cache.context,queries:cache.queries})}:
-        {stdio:['ignore','pipe','pipe']})});
+    const out=spawnSync(argv[0],[...argv.slice(1),'--redue-context'],{
+      cwd:row.plan.cwd,timeout:10000,maxBuffer:1024*1024,env:traceEnvironment(),stdio:['ignore','pipe','pipe']});
     mark('daemon.probe_complete',{mode:'certificate',childPid:out.pid,exit:out.status,signal:out.signal,code:out.error?.code});
     metrics.probeContextProcesses=(metrics.probeContextProcesses||0)+1;
-    let stillValid=!macDirect;
-    if(macDirect)try{stillValid=macProbeBarrier()&&inputKey(row)===key&&planGuard(index.bundle)===guard;}catch{}
-    if(!out.error&&!out.signal&&out.status===0&&
-      out.stdout.toString()===cache.context&&stillValid){
+    if(!out.error&&!out.signal&&out.status===0&&out.stdout.toString()===row.probeCache.context){
       row.probeHash=row.probeCache.hash;row.probeAt=Date.now();row.probeError=null;
       metrics.probeReuses=(metrics.probeReuses||0)+1;
       timing('daemon.probe_context_validation',started,{outcome:'reused',reason:'content_and_context_unchanged'});
       return;
     }
-    guardReason='context_or_compiler_queries_changed';
+    fullReason='context_or_compiler_queries_changed';
     timing('daemon.probe_context_validation',started,{outcome:'changed_or_unavailable'});
   }
-  if(macDirect&&cache?.guard&&guard!==cache.guard)planDirty=true;
-  const fullReason=forceFull?'forced_full_reference':guardReason||
-    (macDirect&&!macGuarded?'mac_validation_basis_unavailable':!cacheable?'generic_probe':
-    !row.probeCache?'no_validated_result':row.probeCache.input!==key?'inputs_changed':'context_changed');
-  timing('daemon.probe_reason',started,{reason:fullReason});
-  metrics.fullProbeReasons??={};metrics.fullProbeReasons[fullReason]=(metrics.fullProbeReasons[fullReason]||0)+1;
-  metrics.fullProbes=(metrics.fullProbes||0)+1;
+  fullReason??=forceFull?'forced_full_reference':!cacheable?'generic_probe':
+    !row.probeCache?'no_validated_result':row.probeCache.input!==key?'inputs_changed':'context_changed';
+  if(row.plan.probes.length){
+    timing('daemon.probe_reason',started,{reason:fullReason});
+    metrics.fullProbeReasons??={};metrics.fullProbeReasons[fullReason]=(metrics.fullProbeReasons[fullReason]||0)+1;
+    metrics.fullProbes=(metrics.fullProbes||0)+1;
+  }
   // A failed or incomplete full probe must not leave an older certificate usable.
-  if(macDirect)row.probeCache=null;
+  let basis=checked.basis||null;
+  if(inProcess){
+    if(!basis)try{basis=certificateBasis(row);}catch{}
+    if(row.probeCache?.guard&&basis&&basis.guard!==row.probeCache.guard)planDirty=true;
+    row.probeCache=null;
+  }
   const values=[];let checkpoint=null;
   for(const argv of row.plan.probes) {
     // Supported TypeScript probes perform bounded input/toolchain hashing.
@@ -227,6 +265,10 @@ function probe(row,allowReuse=false) {
       try{checkpoint=JSON.parse(out.stdout);
         checkpoint.queries=checkpoint.queryData?JSON.parse(inflateSync(
           Buffer.from(checkpoint.queryData,'base64'),{maxOutputLength:8*1024*1024})):null;
+        // Optional: without a layout, a run after an edit falls back to a full probe.
+        try{checkpoint.layout=checkpoint.layoutData?JSON.parse(inflateSync(
+          Buffer.from(checkpoint.layoutData,'base64'),{maxOutputLength:8*1024*1024})):null;}
+        catch{checkpoint.layout=null;}
         if(!/^[a-f0-9]{64}$/.test(checkpoint.output)||!/^[a-f0-9]{64}$/.test(checkpoint.context))
           throw Error('invalid supported probe checkpoint');}
       catch{row.probeHash=null;row.probeAt=0;row.probeError='probe checkpoint unavailable';return;}
@@ -237,9 +279,11 @@ function probe(row,allowReuse=false) {
   if((row.probeHash!==null&&row.probeHash!==value)||row.probeError){
     row.revision++;row.lastReason='declared state probe changed or recovered';}
   row.probeHash=value;row.probeAt=Date.now();row.probeError=null;
-  if(checkpoint)row.probeCache=checkpoint.queries?{input:key,context:checkpoint.context,
-    hash:value,queries:checkpoint.queries,...(macDirect?{schema:1,guard,
-      output:checkpoint.output,queryData:checkpoint.queryData,stderrHash:values[0][3]}: {})}:null;
+  if(checkpoint)row.probeCache=checkpoint.queries&&(!inProcess||basis)?{input:key,context:checkpoint.context,
+    hash:value,queries:checkpoint.queries,...(inProcess?{schema:1,...basis,
+      identities:new Map(),
+      output:checkpoint.output,queryData:checkpoint.queryData,layout:checkpoint.layout,
+      stderrHash:values[0][3]}: {})}:null;
   timing('daemon.probe',started,{outcome:'ok',commands:values.length,
     reusable:row.probeCache?1:0,queries:row.probeCache?.queries.length||0});
 }
@@ -295,7 +339,10 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       item.reason='input coverage unresolved: '+row.plan.unresolved.join('; ')+checkpoint+probeIssue;
       return item;
     }
-    if(row.probeError||!row.probeAt||Date.now()-row.probeAt>10000){item.reason=row.probeError||'state probe observation expired';return item;}
+    if(row.probeError){item.reason=row.probeError;return item;}
+    // An expired probe or missing execution context cannot confirm CURRENT, but
+    // observed input content that already differs from the receipt is STALE.
+    let unconfirmed=!row.probeAt||Date.now()-row.probeAt>10000?'state probe observation expired':null;
     if(row.plan.synchronizedInstalledRead&&!synchronizedInstalled){
       item.reason='installed inputs require a synchronized content read';return item;}
     if(process.platform==='win32'&&!synchronizedFilesystem){
@@ -308,15 +355,15 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       item.reason=`target execution ${r.target?.status||'unavailable'}`;return item;}
     if(r.target.status==='failed'&&result!=='FAIL'){
       item.reason='target failure conflicts with outer invocation outcome';return item;}
-    if(!r.stable){item.reason='inputs changed during execution or observation gap';return item;}
+    if(!r.stable){const issues=r.checkpoint?.issues?.length?` (${r.checkpoint.issues.join('; ')})`:'';
+      item.reason=`inputs changed during execution or observation gap${issues}`;return item;}
     const names=[...(row.plan.environment.variables||[]),
       ...(row.plan.environment.prefixes||[]).map(prefix=>
         `__vstate_env_prefix_${prefix.toLowerCase()}__`),
       ...(row.plan.environment.pathExecutables||[]).map(name=>
         `__vstate_path_executable_${name}__`),
       ...(row.plan.environment.executableIdentity?['__vstate_node_identity__']:[])];
-    if(names.length&&!contextHashes?.[name]){
-      item.reason='execution environment context not supplied';return item;}
+    if(names.length&&!contextHashes?.[name])unconfirmed??='execution environment context not supplied';
     item.freshness='STALE';
     if(r.planId!==row.plan.id){
       const before=new Map((r.resolutionLinks||[]).map(link=>[link.path,link.targetHash]));
@@ -324,7 +371,7 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       item.reason=changed?`installed input link changed: ${changed.path}`:'input plan changed';
       if(changed)item.changed_inputs=[changed.path];
     }
-    else if(names.some(key=>contextHashes[name]?.[key]!==r.environmentHashes?.[key]))
+    else if(contextHashes?.[name]&&names.some(key=>contextHashes[name][key]!==r.environmentHashes?.[key]))
       item.reason='declared execution environment changed';
     else if(r.fingerprint!==combinedSummary(name).fingerprint) {
       const key=r.fingerprint+'\0'+combinedSummary(name).fingerprint;
@@ -346,11 +393,63 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
         row.staleReasonKey=key;
       }
       item.reason=row.staleReason;item.changed_inputs=row.staleInputs||[];
+      if(unconfirmed&&!(r.files&&row.staleInputs?.length)){item.freshness='UNVERIFIED';
+        item.reason=unconfirmed;item.changed_inputs=[];}
+    } else if(unconfirmed){item.freshness='UNVERIFIED';item.reason=unconfirmed;
     } else {item.freshness='CURRENT';item.reason=result==='FAIL'?'last command failed':'declared inputs match';
       item.reuse_eligible=result==='PASS';}
     return item;
   });
 }
+// The indexed inputs already differ from the latest receipt, so no probe result
+// can make this check CURRENT. A sync answers STALE without a full probe. A run
+// probes, or builds the certificate from its recording (adopt), and a revert
+// makes the inputs match and probes again.
+function knownStale(name,row) {
+  const r=receipts[name];
+  if(!r?.files||r.planId!==row.plan.id||row.probeError||pendingChecks.has(name)||
+    row.probeCache?.input===inputKey(row))return false;
+  const current=combinedFiles(name),files=Object.keys(current);
+  return files.length!==Object.keys(r.files).length||files.some(file=>r.files[file]!==current[file]);
+}
+// A run can rebuild a certificate that no longer applies only because indexed
+// inputs changed: same plan guard, compiler, toolchain and observation.
+function adoptable(row) {
+  const cache=row.probeCache;
+  if(process.platform==='win32'||row.plan.qualification!=='npm-typescript-direct-v1'||
+    row.plan.unresolved.length||row.probeError||cache?.schema!==1||!cache.layout||!cache.queries?.length||
+    cache.input===inputKey(row)||cache.gaps!==metrics.gaps||!continuityBarrier())return false;
+  try{const basis=certificateBasis(row);
+    return basis.guard===cache.guard&&basis.compiler===cache.compiler&&basis.toolchain===cache.toolchain;}
+  catch{return false;}
+}
+// The end checkpoint of a run that started without a certificate. Its recorded
+// answers become the candidate certificate when nothing observed changed during
+// the run. The probe that follows validates it, or runs in full as before.
+function adopt(name,row,token) {
+  const started=performance.now(),pending=row.adoption,file=path.join(state,`run-record-${token}.json`);
+  row.adoption=null;
+  let text=null;
+  try{text=fs.readFileSync(file,'utf8');}catch{}
+  const done=issue=>{timing('daemon.recorded_certificate',started,{outcome:issue?'rejected':'accepted',
+    ...(issue?{reason:issue}:{})});return issue;};
+  if(!pending||pending.token!==token||text===null)return done('recording unavailable');
+  if(inputEventSerial.get(name)!==pending.serial||metrics.gaps!==pending.gaps||inputKey(row)!==pending.input||
+    row.probeCache!==pending.cache||row.probeHash!==null)
+    return done('inputs or certificate changed during the run');
+  const cache=pending.cache,argv=row.plan.probes[0];
+  let result;
+  try{result=recordedCertificate(text,cache,directProject(argv[2],argv[3],{verify:false}));}
+  catch{return done('recording unreadable');}
+  if(result.issue)return done(result.issue);
+  const identities=new Map(cache.identities);
+  for(const changed of result.changed)identities.delete(changed);
+  row.probeCache={...cache,hash:directProbeValue(argv,result.output,cache.stderrHash),
+    queries:result.queries,identities,output:result.output,layout:result.layout,input:pending.input,recorded:token,
+    queryData:deflateSync(JSON.stringify(result.queries)).toString('base64')};
+  metrics.recordedCertificates=(metrics.recordedCertificates||0)+1;
+  return done(null);
+}
 function status(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=false) {
   // Reload notifications accelerate visibility but are not required for it: a
   // wrapper may persist its outcome even when its control connection is denied.
@@ -451,7 +550,7 @@ function buildInWorker(forceCold=false,reuse=null) {
       reject(Error(`input-plan worker exited ${code}`));}});
   });
 }
-async function refreshPlan({forceCold=false,reuse=false}={}) {
+async function refreshPlan({forceCold=false,reuse=false,skip=null}={}) {
   if(planning||stopping)return;
   const totalStarted=performance.now();
   const previousProbes=new Map([...(index?.checks||[])].map(([name,row])=>[name,row.probeCache]));
@@ -534,7 +633,8 @@ async function refreshPlan({forceCold=false,reuse=false}={}) {
     atomic(path.join(state,'plans-v1.json'),persistedPlan(bundle));
     metrics.lastPlanPersistenceMs=performance.now()-persistenceStarted;
     const probeStarted=performance.now();
-    for(const row of index.checks.values())probe(row,built.planReused);
+    if(skip)refreshReceipts();
+    for(const [name,row] of index.checks)if(!skip?.(name,row))probe(row,built.planReused);
     timing('daemon.plan_probes',probeStarted,{checks:index.checks.size});
     lastObservation=Date.now();
     event(built.planReused?'plan_validated':'plan_rebuilt',{checks:Object.keys(bundle.plans),workspace_count:bundle.workspaceCount});
@@ -630,14 +730,18 @@ function pnpmTopologyChanged(type,rel) {
     return stat.isDirectory()||stat.isSymbolicLink();}
   catch(e){return e.code==='ENOENT';}
 }
-function markInputEvent(name,rel,type) {
+function markInputEvent(name,rel,type,replay) {
   pendingChecks.add(name);
-  inputEventSerial.set(name,(inputEventSerial.get(name)||0)+1);
+  // macOS delivers each edit twice: live, and again from history replay. The
+  // live copy can arrive late, inside a later run. With history, count only the
+  // replay copy: the history cursor places it in the right interval.
+  if(!hasHistory||historyDisabled||replay)
+    inputEventSerial.set(name,(inputEventSerial.get(name)||0)+1);
   // Disposable public CI only. Never enabled for normal/local repositories.
   if(process.env.REDUE_PUBLIC_INPUT_TRACE==='1'&&rel&&diagnosticInputEvents++<5000)
-    event('public_input_notification',{path:rel,type:type||'unknown',planning});
+    event('public_input_notification',{path:rel,type:type||'unknown',planning,replay});
 }
-function notification(type,filename) {
+function notification(type,filename,replay=false) {
   metrics.notifications++;
   metrics.lastNotificationAt=Date.now();
   if(!filename){observationGap('unnamed_event');return;}
@@ -645,7 +749,7 @@ function notification(type,filename) {
   if(rel==='.git'||rel.startsWith('.git/'))return;
   if(planning) {
     if(index)for(const name of index.candidates(rel))
-      if(index.matches(index.checks.get(name),rel))markInputEvent(name,rel,type);
+      if(index.matches(index.checks.get(name),rel))markInputEvent(name,rel,type,replay);
     pending.add(rel);metrics.maxQueue=Math.max(metrics.maxQueue,pending.size);
     if(planTrigger(rel)||candidateDescendants.has(rel)||pnpmTopologyChanged(type,rel))
       planDirty=true;
@@ -669,9 +773,9 @@ function notification(type,filename) {
   pending.add(rel);metrics.maxQueue=Math.max(metrics.maxQueue,pending.size);
   if(index) {
     for(const name of index.candidates(rel))
-      if(index.matches(index.checks.get(name),rel))markInputEvent(name,rel,type);
+      if(index.matches(index.checks.get(name),rel))markInputEvent(name,rel,type,replay);
     for(const [prefix,names] of index.prefixes)
-      if(prefix.startsWith(rel+'/'))for(const name of names)markInputEvent(name,rel,type);
+      if(prefix.startsWith(rel+'/'))for(const name of names)markInputEvent(name,rel,type,replay);
   }
   if(pending.size>50000){healthy=false;reason='observation backlog overflow';metrics.gaps++;
     event('observation_gap',{classification:'backlog_overflow'});publish();
@@ -680,23 +784,23 @@ function notification(type,filename) {
   if(planDirty){healthy=false;reason='input plan possibly changed';}
   if(planDirty||pendingChecks.size)publish();
 }
-function externalNotification(entry,type,filename) {
+function externalNotification(entry,type,filename,replay=false) {
   metrics.notifications++;
   metrics.lastNotificationAt=Date.now();
   if(!filename){externalGap(entry,'unnamed_event');return;}
   const rel=filename.toString().split(path.sep).join('/');
   const absolute=path.join(entry.root,rel);
   if(planning&&entry.index)for(const name of entry.index.candidates(rel))
-    if(entry.index.matches(entry.index.checks.get(name),rel))markInputEvent(name,rel,type);
+    if(entry.index.matches(entry.index.checks.get(name),rel))markInputEvent(name,rel,type,replay);
   if(planTrigger(absolute)&&triggerChanged(absolute))planDirty=true;
   if(candidateTriggerChanged(absolute))planDirty=true;
   entry.pending.add(rel);metrics.maxQueue=Math.max(metrics.maxQueue,
     pending.size+[...external.values()].reduce((n,e)=>n+e.pending.size,0));
   if(entry.index) {
     for(const name of entry.index.candidates(rel))
-      if(entry.index.matches(entry.index.checks.get(name),rel))markInputEvent(name,rel,type);
+      if(entry.index.matches(entry.index.checks.get(name),rel))markInputEvent(name,rel,type,replay);
     for(const [prefix,names] of entry.index.prefixes)
-      if(prefix.startsWith(rel+'/'))for(const name of names)markInputEvent(name,rel,type);
+      if(prefix.startsWith(rel+'/'))for(const name of names)markInputEvent(name,rel,type,replay);
   }
   if(planDirty){healthy=false;reason='input plan possibly changed';}
   publish();clearTimeout(flushTimer);flushTimer=setTimeout(flush,60);
@@ -714,7 +818,8 @@ function observationGap(classification,error) {
   // Once continuity is uncertain, a cursor is no longer authority. Do not
   // retry native history in this observer generation after reconciliation.
   historyDisabled=true;
-  healthy=false;reason=`observation unavailable: ${classification}; deterministic reconciliation pending`;
+  const cause=error?.message?` (${error.message})`:'';
+  healthy=false;reason=`observation unavailable: ${classification}${cause}; deterministic reconciliation pending`;
   metrics.gaps++;
   event('observation_gap',{classification,error_code:error?.code||null});publish();
   // One bounded attempt per gap; a later independent gap may try again.
@@ -807,7 +912,7 @@ async function catchUp() {
     if(!fs.existsSync(snapshotPath))throw Error('historical cursor missing');
     {
       const changes=await queryHistory(root,snapshotPath,'root replay');
-      for(const change of changes)notification(change.type,path.relative(root,change.path));
+      for(const change of changes)notification(change.type,path.relative(root,change.path),true);
       if(!planning&&(flushTimer||pending.size||planDirty))flush();
       for(const entry of external.values())if(entry.index) {
         try{
@@ -817,7 +922,7 @@ async function catchUp() {
           if(!entry.watcher||!fs.existsSync(entry.snapshot))throw Error('external cursor unavailable');
           const changes=await queryHistory(entry.root,entry.snapshot,'external replay');
           for(const change of changes)externalNotification(entry,change.type,
-            path.relative(entry.root,change.path));
+            path.relative(entry.root,change.path),true);
         }catch(e){if(e.code==='ETIMEDOUT')throw e;
           externalGap(entry,'historical_replay_failed',e);}
       }
@@ -869,9 +974,17 @@ async function request(message) {
     // has been disabled: a recovered subscription may still have queued events.
     const needsContentReconciliation=process.platform==='win32'||(hasHistory&&historyDisabled);
     if(needsContentReconciliation&&message.action!=='prelaunch'){
-      const started=performance.now();await refreshPlan({forceCold:true,reuse:true});
+      // Windows probes inside the reconciliation, so a known-STALE sync skips it there.
+      const started=performance.now();
+      await refreshPlan({forceCold:true,reuse:true,skip:message.action==='sync'?knownStale:null});
       timing('daemon.request_content_validation',started,{healthy:healthy?1:0});}
-    if(healthy)try{const started=performance.now();await catchUp();
+    // Without synchronized installed reads, the continuity barrier runs once,
+    // after probing: in-process validation reads the live filesystem, and the
+    // barrier then applies every change before the response is computed.
+    const deferBarrier=process.platform!=='win32'&&!needsContentReconciliation&&
+      message.action!=='prelaunch'&&index&&healthy&&!planning&&![...index.checks].some(([name,row])=>
+        row.plan.synchronizedInstalledRead&&(!message.name||message.name===name));
+    if(healthy&&!deferBarrier)try{const started=performance.now();await catchUp();
       timing('daemon.request_catch_up',started);}catch(e){observationGap('historical_query',e);}
     if(flushTimer||pending.size||planDirty||[...external.values()].some(e=>e.pending.size))flush();
     let synchronizedInstalled=false;
@@ -906,17 +1019,49 @@ async function request(message) {
       }catch(e){installedRecheck=null;observationGap('installed_recheck',e);}
     }
     const probeStarted=performance.now();
+    // A run's start checkpoint skips the full probe when its recording can
+    // replace the certificate; the end checkpoint offers that recording.
+    let adoptIntent=false,recorded;const adopting=new Set();
     if(index&&healthy&&!validatedColdIndex&&message.action!=='prelaunch'){
-      const macReuse=macProbeBarrier();
-      for(const row of index.checks.values())probe(row,macReuse);
-      if(macReuse&&process.env.VSTATE_TEST_FAULTS==='1'&&process.env.VSTATE_TEST_MAC_PROBE_SIGNAL){
+      const continuous=continuityBarrier(),probed=index,gaps=metrics.gaps,decided=Date.now();
+      const selected=[...index.checks].filter(([name])=>!message.name||message.name===name);
+      if(message.action==='snapshot'&&typeof message.adopt==='string'&&/^[0-9a-f-]{36}$/.test(message.adopt)){
+        const row=index.checks.get(message.name);
+        recorded=row?adopt(message.name,row,message.adopt):'recording unavailable';
+      }
+      adoptIntent=message.action==='snapshot'&&message.runCertificate===1&&!message.adopt&&continuous;
+      const keys=new Map(selected.map(([name,row])=>[name,inputKey(row)]));
+      const skip=message.action==='sync'?knownStale:()=>false;
+      if(message.action==='sync')refreshReceipts();
+      // With a deferred barrier, validate in-process first and launch any full
+      // probe only after the barrier, so a queued edit costs one probe, not two.
+      for(const [name,row] of selected)if(!skip(name,row))probe(row,continuous,{launch:!deferBarrier&&!adoptIntent});
+      if(continuous&&process.env.VSTATE_TEST_FAULTS==='1'&&process.env.VSTATE_TEST_MAC_PROBE_SIGNAL){
         fs.writeFileSync(process.env.VSTATE_TEST_MAC_PROBE_SIGNAL,'validated');
         await new Promise(resolve=>setTimeout(resolve,200));
       }
-      // Child validation blocks JS event delivery. Finish with another continuity
+      // Validation and probes block JS event delivery. Finish with a continuity
       // barrier so queued edits/gaps cannot be published using the pre-probe index.
-      if(macReuse)try{await catchUp();if(planDirty||pending.size||flushTimer)flush();}
-        catch(e){observationGap('post_probe_history',e);}
+      if(continuous||deferBarrier)try{const started=performance.now();
+        await catchUp();if(planDirty||pending.size||flushTimer)flush();
+        timing('daemon.request_catch_up',started,{after:'probes'});
+        // Rows not yet confirmed, or whose inputs moved meanwhile, are probed
+        // from the barrier, as an undeferred decision would have done.
+        // Decided once, after the barrier. The start probe value is already out
+        // of date; clearing it means whichever probe comes next sets the value
+        // for this unchanged interval without counting as a change during the run.
+        if(adoptIntent&&index===probed&&healthy&&!planning)for(const [name,row] of selected)
+          if(row.probeAt<decided&&adoptable(row)){
+            adopting.add(name);row.probeHash=null;
+            row.adoption={token:randomUUID(),serial:inputEventSerial.get(name)||0,gaps:metrics.gaps,
+              input:inputKey(row),cache:row.probeCache};
+          }
+        const rest=index===probed&&healthy&&!planning?selected.filter(([name,row])=>!skip(name,row)&&
+          !adopting.has(name)&&(row.probeAt<decided||metrics.gaps!==gaps||inputKey(row)!==keys.get(name))):[];
+        const launched=metrics.fullProbes||0;
+        for(const [,row] of rest)probe(row,continuityBarrier());
+        if(continuous&&(metrics.fullProbes||0)>launched){await catchUp();if(planDirty||pending.size||flushTimer)flush();}
+      }catch(e){observationGap('post_probe_history',e);}
     }
     timing('daemon.request_probes',probeStarted,{checks:index?.checks.size||0});
     lastObservation=Date.now();publish();
@@ -929,22 +1074,31 @@ async function request(message) {
           data.snapshots[name]={...combinedSummary(name),files:combinedFiles(name),
           planGeneration:row.plan.id,
             inputEventSerial:inputEventSerial.get(name)||0,
-            probeHash:row.probeHash,
+            probeHash:row.probeHash,inputKey:inputKey(row),observationGaps:metrics.gaps,
             observationHealthy:healthy&&!planning&&!recovering&&applicableExternal(name).every(e=>e.healthy)};
       // Export only a currently guarded, check-specific discovery certificate.
-      // The caller must independently validate it in its own environment. The
+      // The caller compares it with the answers its own compile received. Schema 2
+      // certifies the realpath of every directory readDirectory visits. The
       // snapshot stays the start of the observed interval, including validation.
-      if(message.runCertificate===1&&macProbeBarrier()){
+      if(message.runCertificate===1&&continuityBarrier()){
         const row=index?.checks.get(message.name),cache=row?.probeCache;
-        if(row?.plan.qualification==='npm-typescript-direct-v1'&&
+        // The daemon checked the recording against the certificate it then validated.
+        if(recorded===null&&cache?.recorded===message.adopt&&cache.hash===row.probeHash&&
+          cache.input===inputKey(row)&&data.snapshots[message.name])
+          data.snapshots[message.name].recordingAccepted=true;
+        else if(row?.plan.qualification==='npm-typescript-direct-v1'&&
           !row.plan.unresolved.length&&cache?.schema===1&&cache.input===inputKey(row)&&
           cache.hash===row.probeHash&&cache.guard===planGuard(index.bundle)&&
           cache.output&&cache.queryData&&data.snapshots[message.name])
-          data.snapshots[message.name].discoveryCertificate={schema:1,planId:row.plan.id,
+          data.snapshots[message.name].discoveryCertificate={schema:2,planId:row.plan.id,
             cwd:row.plan.cwd,probeDefinition:sha(JSON.stringify(row.plan.probes)),
             context:cache.context,output:cache.output,stderrHash:cache.stderrHash,
             queryData:cache.queryData};
       }
+      const row=index?.checks.get(message.name);
+      if(adopting.has(message.name)&&row?.adoption&&data.snapshots[message.name])
+        data.snapshots[message.name].recordedCertificate=row.adoption.token;
+      if(typeof recorded==='string'&&data.snapshots[message.name])data.snapshots[message.name].recordingIssue=recorded;
     }
     timing('daemon.request_applicability',applicabilityStarted,{checks:data.checks.length});
     timing('daemon.request_total',totalStarted,{action:message.action,
@@ -968,7 +1122,7 @@ async function shutdown() {
         healthy=true;retainIndex();healthy=false;}
     } catch(e){event('index_retention_unavailable',{classification:e.name||'Error'});}
   }
-  planningWorker?.terminate().catch(()=>{});
+  closeHistory();planningWorker?.terminate().catch(()=>{});
   clearInterval(heartbeat);clearInterval(probeTimer);clearTimeout(recoveryTimer);
   watcher?.unsubscribe().catch(()=>{});server.close();
   for(const entry of external.values()){
@@ -1056,21 +1210,21 @@ const heartbeat=setInterval(()=>{
   }
   publish();
 },1000);
+// Idle revalidation keeps probe results fresh for cached status without
+// launching a process: certificates are replayed in-process, and one that no
+// longer holds expires so the next decision runs the full probe. macOS history
+// replay would fork, so cached status there relies on live notifications.
 const probeTimer=setInterval(()=>traceScope({request:traceId(),work:'periodic'},async()=>{
   mark('server.periodic_start',{pending:pending.size,planDirty,planning,decisionRequests});
   // Windows cached reads are conservatively UNVERIFIED until a full decision
-  // reconciliation. Periodic synchronous probes cannot strengthen that cache,
-  // but can block control requests behind several seconds of child work.
+  // reconciliation, so idle revalidation cannot strengthen them.
   if(process.platform==='win32')return;
-  if(healthy&&index&&!planning&&!decisionRequests){
-  try{await catchUp();
-    if(healthy&&!planning&&!recovering){const macReuse=macProbeBarrier();
-      for(const row of index.checks.values())probe(row,macReuse);
-      if(macReuse){await catchUp();if(planDirty||pending.size||flushTimer)flush();}
-    }
-    publish();}
-  catch(e){observationGap('periodic_query',e);}
-}
+  if(healthy&&index&&!planning&&!recovering&&!decisionRequests){
+    try{if(!hasHistory)await catchUp();}catch(e){observationGap('periodic_query',e);}
+    if(healthy&&index&&!planning&&!recovering)
+      for(const row of index.checks.values())probe(row,true,{launch:false});
+    if(planDirty)flush();else publish();
+  }
   mark('server.periodic_complete');
 }),5000);
 process.on('uncaughtExceptionMonitor',error=>{

package/src/decision-validation.mjs

@@ -39,3 +39,13 @@ export function planGuard(bundle) {
   const rootStat=fs.statSync(root,{bigint:true});
   return sha(JSON.stringify([String(rootStat.dev),String(rootStat.ino),values]));
 }
+// Identity of the reviewed compiler tree and the probe's Node executable. A full
+// probe verifies their bytes after this is taken, so any later write changes it.
+export function toolchainKey(tsRoot,executable) {
+  const values=[];
+  const visit=file=>{const st=fs.lstatSync(file,{bigint:true});
+    values.push([file,...['dev','ino','mode','nlink','size','mtimeNs','ctimeNs'].map(key=>String(st[key]))]);
+    if(st.isDirectory())for(const name of fs.readdirSync(file).sort())visit(path.join(file,name));};
+  visit(tsRoot);visit(fs.realpathSync(executable));
+  return sha(JSON.stringify(values));
+}